Get certified in 90 days. Then keep it.
Enterprise procurement checklists have changed. Security questionnaires that once asked about your password policy now include a line item for ISO 27001 certification — and leaving it blank costs you the deal.
Investors are increasingly asking for it during due diligence as well. A certification signals that your security posture is independently verified, not just claimed. For Series A and beyond, it removes a common blocker.
The NIS2 directive is also driving demand across Europe. Whether or not NIS2 applies to you directly, your customers' compliance obligations are pushing ISO 27001 down their supply chains — and that means you.
Without certification, you are losing deals you do not even know about. Procurement filters happen before the first sales call.
Key facts
The pathway
Assess
A 2–3 week engagement that maps all 93 ISO 27001 controls against your current state. We identify gaps, prioritise remediation, and produce a clear roadmap so you know exactly what needs to happen before your audit.
€2,500 — credited in full to the Sprint if you proceed.
Build
We implement every required technical control and produce the full documentation set: ISMS policy, risk register, Statement of Applicability (SoA), and evidence pack v1. At the end of 90 days, you are ready to engage a certification body.
Fixed €28,000. No surprises.
Run
Maintaining ISO 27001 post-certification requires continuous evidence collection, a rolling policy review cycle, and audit support when your surveillance audits come around. The Compliance Engine handles all of it — quarterly compliance reports included.
From €120/user/month.
Deliverables
Your Information Security Management System, built to clause 4–10 of ISO 27001:2022. Not a template — a living document system tailored to your organisation.
Every identified risk recorded, assessed, and mapped to a treatment decision. Auditors want to see that you understand your risk landscape — this proves it.
All 93 Annex A controls addressed. Each control is marked as applicable or excluded, with a justified rationale. This is the document your auditor will scrutinise first.
Organised, auditor-ready evidence for every implemented control. Screenshots, configuration exports, logs, and access review records — structured so your audit runs smoothly.
Information Security Policy, Acceptable Use Policy, Disaster Recovery Plan, Business Continuity Plan, and Vendor Management Policy — all drafted and approved.
We prepare you for Stage 1 and Stage 2 audits, conduct internal audit walkthroughs, and sit alongside your team during the certification body's review.
FAQ
Talk to us about your timeline, your customer base, and the deals you want to unlock. We will tell you exactly what the path looks like.